ALAS2-2026-4038

Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4038
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
Severity: Important
Issue Overview:

Inbound-message resource exhaustion (CWE-400) leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26. (CVE-2026-19630)

Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. (CVE-2026-94300)


Affected Packages:

bind


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update bind or yum update --advisory ALAS2-2026-4038 to update your system.

New Packages:
aarch64:
    bind-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-pkcs11-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-sdb-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-libs-lite-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-libs-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-utils-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-devel-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-lite-devel-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-chroot-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-export-libs-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-export-devel-9.11.4-26.P2.amzn2.13.20.aarch64
    bind-debuginfo-9.11.4-26.P2.amzn2.13.20.aarch64

i686:
    bind-9.11.4-26.P2.amzn2.13.20.i686
    bind-pkcs11-9.11.4-26.P2.amzn2.13.20.i686
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.20.i686
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.20.i686
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.20.i686
    bind-sdb-9.11.4-26.P2.amzn2.13.20.i686
    bind-libs-lite-9.11.4-26.P2.amzn2.13.20.i686
    bind-libs-9.11.4-26.P2.amzn2.13.20.i686
    bind-utils-9.11.4-26.P2.amzn2.13.20.i686
    bind-devel-9.11.4-26.P2.amzn2.13.20.i686
    bind-lite-devel-9.11.4-26.P2.amzn2.13.20.i686
    bind-chroot-9.11.4-26.P2.amzn2.13.20.i686
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.20.i686
    bind-export-libs-9.11.4-26.P2.amzn2.13.20.i686
    bind-export-devel-9.11.4-26.P2.amzn2.13.20.i686
    bind-debuginfo-9.11.4-26.P2.amzn2.13.20.i686

noarch:
    bind-license-9.11.4-26.P2.amzn2.13.20.noarch

src:
    bind-9.11.4-26.P2.amzn2.13.20.src

x86_64:
    bind-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-pkcs11-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-sdb-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-libs-lite-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-libs-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-utils-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-devel-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-lite-devel-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-chroot-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-export-libs-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-export-devel-9.11.4-26.P2.amzn2.13.20.x86_64
    bind-debuginfo-9.11.4-26.P2.amzn2.13.20.x86_64

Additional References

Red Hat: CVE-2026-19630, CVE-2026-94300

Mitre: CVE-2026-19630, CVE-2026-94300